Hooks: How a Rule Goes From Advisory to Actually Enforced
Writing a rule more forcefully doesn't make an AI agent obey it every time. If something must never happen no matter how it's phrased, it belongs in an automated check, not a stronger sentence in a prompt, and the two tools we run handle that check very differently.
Every instructions file an AI agent reads, no matter how many capital letters or exclamation points get added to it, is still just context the agent interprets. It can misread it, deprioritize it under a run of fast decisions, or simply not think to apply it in an edge case nobody anticipated. That's true of a one-line preference and a page-long compliance policy alike. A hook is different in kind, not degree.
What a hook actually is
A hook is an automated check the harness runs at a specific event, not something the agent chooses to run or can talk itself out of. It executes outside the agent's reasoning entirely, so it still fires even if the agent misreads, forgets, or deprioritizes the underlying instruction in a given moment. Which events are available, and how granular they are, varies by tool.
A hook can block outright, a hard stop the agent has to resolve before continuing, or just log and notify, a soft signal that's visible but doesn't stop anything. Matching the hook type to how serious the underlying rule actually is matters: not everything needs a hard stop, but anything expensive, embarrassing, or irreversible to get wrong probably does.
A worked example
The em-dash rule
- Written as plain instructions: "never use an em dash." Advisory on its own, the agent has to remember and apply it correctly every single time, with no backstop.
- Paired with an automated check: a check bound to file-edit actions scans the changed file for the em dash character and its HTML entity forms after every edit, and returns a blocking error if it finds one.
- Result: the agent has to fix the file before the turn is treated as complete, including catching pre-existing instances it didn't introduce itself and wouldn't otherwise have noticed.
The general pattern for any "never do X" rule
Stays advisory
- Style and tone preferences with room for judgment
- Guidance that depends on context to apply well
- Anything where an occasional miss is a minor cost
Belongs in an automated check
- Security and secrets handling, brand and compliance requirements
- Anything where one miss is expensive, embarrassing, or irreversible
- Rules you've already had to correct more than once
How this looks in the tools we actually use
This is the piece where the two tools diverge the most. One has a native, general-purpose hook system built for exactly this. The other leans on pairing its instructions file with tooling outside the agent itself.
Claude Code
A native hook system with several lifecycle events to bind a check to:
- PostToolUse: checks the result of a tool call, for example scanning a file right after it's edited.
- PreToolUse: blocks a tool call before it runs, for example refusing a destructive command outright.
- SessionStart: runs a check the moment a project opens, before any other work happens.
- Stop: runs a check before the agent is allowed to end its turn.
This is exactly the approach we're applying to our own brand style guide as we publish this series: a hook that scans new or edited pages against the approved color and type tokens, not just a written rule asking for it.
ChatGPT Codex
A much narrower native surface. Codex added its first hooks in September 2026, Interrupt hooks, which run when an active turn gets cut short, not a general before/after-every-action system. For broader enforcement, OpenAI's own guidance is to pair AGENTS.md with tooling outside the agent: add pre-commit hooks and linters to enforce the rules, so a type checker or lint rule catches a violation the agent introduces, rather than the agent's own harness blocking it in the moment.
Practically: if a rule must hold with zero exceptions in a Codex-driven workflow, expect to build that guarantee at the CI or pre-commit layer, not inside Codex itself.
Rule of thumb
If a violation would be expensive, embarrassing, or irreversible, don't leave it as prose in an instructions file alone. Write an automated check for it, whatever form that takes in the tool you're actually running.